chore: re-profile the Pizza Boy cores

The native refs move to the newest genuine Basic builds (GBA 2.3.20, GBC 4.1.14, SC 1.2.14), which add a save-state check of the BIOS area and new zip handling. The Pro releases the store announces circulate only rebuilt, so the Pro Java reading stays on the last genuine build and the release is named in no_genuine_copy.
This commit is contained in:
Abdessamad Derraz committed 2026-10-20 04:59:01 +02:00
1 parent a20948d7d5
commit d7439de393
3 files changed
+121 -90

No files matched your search

+28 -11
View File
@@ -6,8 +6,9 @@ upstream: closed-source
version_source:
url: "https://play.google.com/store/apps/details?id=it.dbtecno.pizzaboygbapro&hl=en"
pattern: '\[\[\["([^"]+)"\]\],\[\[\[\d+'
no_genuine_copy: "3.8.24"
author: "Pizza Emulators"
profiled_date: "2026-08-12"
profiled_date: "2026-10-20"
core_version: "2.8.13"
display_name: "Nintendo - Game Boy Advance (Pizza Boy GBA)"
mode: standalone
@@ -26,30 +27,39 @@ notes: |
builds are read here, both carrying the source stamp: Pro 2.8.13 (versionCode 343,
Play App Signing certificate sha256
6b5547246e41921f25eba8abb1bc018729c4f0b8db029debbd3380a2b1ec2fe1), which supplies the
Java and the resources, and Basic 2.3.3 (versionCode 236, developer certificate sha256
Java and the resources, and Basic 2.3.20 (versionCode 253, an APKMirror bundle whose
base and arm64-v8a splits carry the developer certificate sha256
b3ee584096acf4667bb9346daa9cce19237ef7ce95c99e9260ac89be0f7d6130, CN=Davide Berra,
O=DBTecno), whose arm64-v8a libpizzaboy-jni.so ships DWARF and an unstripped symbol
table and supplies every native reference below as its own file and line. Java line
numbers are those of Pro 2.8.13. Two rebuilt copies of Pro 1.35.11 were rejected on
their certificate, one signed C=debugging with no source stamp and one signed
O=APKMODY. 69 of the 77 native methods the Pro declares are exported by the Basic
core, the three BIOS entry points among them: one core, compiled per package.
2.3.3 core, the three BIOS entry points among them: one core, compiled per package.
The Pro on the store is 3.8.24 and no genuine copy of it is reachable: apkcombo no
longer resolves, the APKPure API holds no entry for either package, APKMirror and
Uptodown carry the Basic package alone, apkvision stops at Basic 1.9.5, and the
newest archive.org item, labelled Pro 2.8.14, holds no file.
One system is emulated, Game Boy Advance: the core is built from a tree named
pizzaboyadvance whose compilation units carry gba.c and no Game Boy core, and the
three Game Boy Color and Super Game Boy methods the Pro still declares are among the
eight the library does not export.
eight the Basic 2.3.3 library does not export.
The BIOS is the one file the user supplies, and it is read only while Load BIOS file
is on, off by default. The picker and the Run BIOS animation switch, on by default,
both depend on that box (res/xml/pref_general.xml). In the free package the same
three preferences are declared android:enabled="false".
three preferences are declared android:enabled="false". The Basic 2.3.20 Java keeps
the whole handoff to the core behind them, and its document picker copies the
chosen file as it is, with no zip extraction.
A per rom Low precision BIOS set to On clears the stored path and makes the core keep
its own replacement, and one cartridge, checksum 0xc7d89508, forces the same at load
time. When a real image is installed the boot animation starts execution at 0 rather
than at the cartridge entry, and a multiplayer session exchanges the CRC32 of the file
so that both peers run the same one.
so that both peers run the same one. In Basic 2.3.20 a save state records the CRC32
of the 16 KB BIOS area, and a state written under another image is refused with
"Cannot restore stat: saved with another BIOS".
Everything else the app opens it makes itself: boxart.db and cheat.db are created by
their own CREATE TABLE, the default skins, the shaders and the cheat descriptors are
@@ -77,12 +87,19 @@ files:
that a real image is installed. Nothing about the file is examined: any read
returning at least one byte is accepted, and no size, name or hash test exists on
either side of the bridge. A read of zero bytes leaves the replacement in place
and logs "Cannot read BIOS file".
and logs "Cannot read BIOS file". In Basic 2.3.20 the document picker copies the
file into the temp directory under the name the picker reports without opening
a zip, and the legacy browser extracts a picked zip entry under its own name to
the uncompressed directory.
source_ref: "Pizza Boy GBA Pro 2.8.13 SettingsActivity.java:116-140 (import), :143-183
(preference and picker), FileDialog.java:57,72,77,846-857 (legacy browser, zip entry
to bios.bin), Common.java:85-105 (copy to temp), :160-190 (single entry unzip),
MainActivity.java:833,835,865 (bridge), :10936-10941 (gate and handoff),
res/xml/pref_general.xml (defaults); Pizza Boy A Basic 2.3.3 libpizzaboy-jni.so
pizza.c:932-938 (path buffer), :945-946 (boot flag), :632-642 (low precision BIOS),
global.c:93-95 (defaults), mmu.c:1522-1543 (replacement, gate, read, flag),
:2106-2110 (forced HLE), cpu.c:40 (boot vector)"
res/xml/pref_general.xml (defaults); Pizza Boy A Basic 2.3.20
SettingsActivity.java:206-236, xw.java:2531-2554 (copy without zip extraction),
yj.java:279-300 (legacy browser zip entry), h3.java:123-128 (gate and handoff),
lt.java:76-80 (state refused), libpizzaboy-jni.so pizza.c:931-937 (path buffer),
:944-945 (boot flag), :637-646 (low precision BIOS), global.c:22-24, :97-99
(defaults), mmu.c:1840-1853 (replacement, gate, read, flag), :2422-2426 (forced
HLE), cpu.c:34-40 (boot vector), gba.c:2739-2743 (CRC32 in the save state),
:2194-2203 (restore refused)"
+34 -26
View File
@@ -6,8 +6,9 @@ upstream: closed-source
version_source:
url: "https://play.google.com/store/apps/details?id=it.dbtecno.pizzaboypro&hl=en"
pattern: '\[\[\["([^"]+)"\]\],\[\[\[\d+'
no_genuine_copy: "7.4.15"
author: "Pizza Emulators"
profiled_date: "2026-08-12"
profiled_date: "2026-10-20"
core_version: "6.0.6"
display_name: "Nintendo - Game Boy / Color (Pizza Boy GBC)"
mode: standalone
@@ -28,18 +29,19 @@ notes: |
are read here, both carrying the developer certificate sha256
b3ee584096acf4667bb9346daa9cce19237ef7ce95c99e9260ac89be0f7d6130 (CN=Davide Berra,
O=DBTecno) and a source stamp: Pro 6.0.6 (versionCode 231), which supplies the Java
and the resources, and Basic 4.1.6 (versionCode 202), whose arm64-v8a
libpizzaboy-jni.so ships DWARF and an unstripped symbol table and supplies every
native reference below as its own file and line. Java line numbers are those of Pro
6.0.6. The Pro on the store is 7.4.5 (versionCode 324) and no genuine copy of it is
reachable: apkcombo bounces the download page of a paid app back to the app page,
apkvision carries no copy, and archive.org holds 6.0.6 alone. The Pro ships its core
as a stripped armeabi-v7a build. It carries the same log strings and the same
constants as the Basic core, the 64 KB clear, the 8192 byte read cap, the 256 byte
header copy and the 256 and 2304 byte gate, and 65 of the 70 entry points it exports
are exported by the Basic core as well. The Pro also ships libpizza-jni.so, an
older core exporting the free package JNI names and carrying no BIOS entry point,
which no loadLibrary call reaches.
and the resources, and Basic 4.1.14 (versionCode 210, an APKMirror bundle), whose
arm64-v8a libpizzaboy-jni.so ships DWARF and an unstripped symbol table and supplies
every native reference below as its own file and line. Java line numbers are those
of Pro 6.0.6 unless a Basic 4.1.14 reference is named. The Pro on the store is 7.4.15
and no genuine copy of it is reachable: apkcombo no longer resolves, the APKPure API
holds no entry for either package, APKMirror and Uptodown carry the Basic package
alone, apkvision stops at Pro 5.2.2, and archive.org holds 6.0.6 alone. The Pro
ships its core as a stripped armeabi-v7a build. It carries the same log strings and
the same constants as the Basic core, the 64 KB clear, the 8192 byte read cap, the
256 byte header copy and the 256 and 2304 byte gate, and 65 of the 70 entry points
it exports are exported by the Basic 4.1.6 core as well. The Pro also ships
libpizza-jni.so, an older core exporting the free package JNI names and carrying no
BIOS entry point, which no loadLibrary call reaches.
Three systems are emulated from one tree named pizzaboy, whose compilation units
carry gameboy.c, mmu.c, sgb.c and camera.c: Game Boy, Game Boy Color and Super Game
@@ -52,8 +54,9 @@ notes: |
The boot ROM is the one file the user supplies, in two slots, Gameboy Classic ROMs
BIOS and Gameboy Color ROMs BIOS, and it is read only while Load BIOS file is on,
off by default (res/xml/pref_general.xml:89-99). In the free package the same three
preferences are declared android:enabled="false" behind a paid badge. A ROM whose
name ends in .gb or .sgb takes the first slot, every other name takes the second.
preferences are declared android:enabled="false" behind a paid badge, and the Basic
4.1.14 Java keeps the whole handoff to the core behind them. A ROM whose name ends
in .gb or .sgb takes the first slot, every other name takes the second.
The library never examines the name, the extension or the content: the byte count of
the read decides the machine. A file of 256 bytes runs the cartridge as a Game Boy,
@@ -64,7 +67,8 @@ notes: |
cartridge entry, and the animation runs until it reaches 0x100, at which point the
active MMU returns to the cartridge and the accumulator is restored. A multiplayer
session exchanges the CRC32 of the Game Boy slot so that both peers run the same
file.
file. The Basic 4.1.14 Java carries no such exchange, and its core skips the boot
while a multiplayer peer is connected.
Everything else the app opens it makes itself: the default skins and the cheat
descriptors are raw resources unpacked at first run, the box art, cheat, sticker,
@@ -96,19 +100,23 @@ files:
Nothing else is examined: no name, size range, header or hash test exists on
either side of the bridge, and a count that is neither 256 nor 2304 is refused.
A multiplayer session exchanges the CRC32 of this file so that both peers run
the same one.
the same one. In Basic 4.1.14 the picker alone remains: the document is copied
into the temp directory, and when its name ends in zip every file entry is
extracted there instead, the last one written becoming the stored path.
source_ref: "Pizza Boy GBC Pro 6.0.6 MainActivity.java:702 (native method),
:8067-8081 (gate and slot selection), :1734-1757 (CRC32 of the file),
:1907, :2136 (multiplayer handshake), SettingsActivity.java:40-41 (request
codes), :96-113 (picker result and copy), :116-192 (both preferences),
Common.java:42 (copy to the application directory), FileDialog.java:949-975
(legacy browser, zip entry to bios.bin), res/xml/pref_general.xml:89-99
(defaults); Pizza Boy C Basic 4.1.6 libpizzaboy-jni.so pizza.c:1023-1024 (path
into global_bios_file), global.c:28 (char[256]), mmu.c:431-463 (open, 64 KB
clear, 8192 byte read, cartridge header copy, 256 and 2304 gate, refusal),
gameboy.c:1161-1168 (conditions and call), :1171, :1238 (failure),
:1179-1198 (model, MMU switch, program counter at 0, accumulator),
:1201-1235 (run to 0x100, return to the cartridge)"
(defaults); Pizza Boy C Basic 4.1.14 MainActivity.java:3196-3202 (gate and slot
selection), SettingsActivity.java:66-155 (picker result, zip entries, copy),
wd.java:1607-1630 (copy to the temp directory), libpizzaboy-jni.so
pizza.c:1028-1029 (path into global_bios_file), global.c:28 (char[256]),
mmu.c:432-463 (open, 64 KB clear, 8192 byte read, cartridge header copy, 256 and
2304 gate, refusal), gameboy.c:1263-1283 (first run, peer and path tests, call),
:1163-1172 (log, read, failure), :1177-1199 (model, MMU switch, program counter
at 0, accumulator, palette), :1202-1242 (run to 0x100, return to the cartridge)"
- name: cgb_boot.bin
system: nintendo-gbc
@@ -128,6 +136,6 @@ files:
gap the 2304 byte layout leaves for it.
source_ref: "Pizza Boy GBC Pro 6.0.6 MainActivity.java:8073-8078 (slot selection),
SettingsActivity.java:98 (preference key), :158-192 (preference and picker),
res/xml/pref_general.xml:97-99; Pizza Boy C Basic 4.1.6 libpizzaboy-jni.so
mmu.c:435-452 (read, header copy, 2304 gate), gameboy.c:1179 (model from the
return value), :1189-1198 (program counter, accumulator, palette)"
res/xml/pref_general.xml:97-99; Pizza Boy C Basic 4.1.14 libpizzaboy-jni.so
mmu.c:435-452 (read, header copy, 2304 gate), gameboy.c:1177-1180 (model from
the return value), :1193-1199 (program counter, accumulator, palette)"
+59 -53
View File
@@ -6,9 +6,10 @@ upstream: closed-source
version_source:
url: "https://play.google.com/store/apps/details?id=it.dbtecno.pizzaboyscpro&hl=en"
pattern: '\[\[\["([^"]+)"\]\],\[\[\[\d+'
no_genuine_copy: "1.4.34"
author: "Pizza Emulators"
profiled_date: "2026-08-12"
core_version: "1.2.4"
profiled_date: "2026-10-20"
core_version: "1.2.14"
display_name: "Sega - MS/GG/MD/CD (Pizza Boy SC)"
mode: standalone
cores:
@@ -28,41 +29,45 @@ notes: |
Pizza Boy SC name, reached by ES-DE through its PIZZA-BOY-SC find rule and started
with the game passed as the rom_uri extra: it.dbtecno.pizzaboyscpro, the paid build
the rule names first, and it.dbtecno.pizzaboyscbasic, the free one. The build read
here is Basic 1.2.4 (versionCode 33), a Play distribution drop carrying the source
stamp and signed by the Play App Signing certificate sha256
5ae32245362ccafab6977e759f658dda66bac81cebdd804581cb55db2f219149. The Pro on the
store is 1.4.25 and no genuine copy of it is reachable: apkcombo bounces the
download page of a paid app back to the app page, apkmirror carries no SC build,
archive.org holds none, and the one apkvision copy, labelled Pro 1.3.7, is signed
CN=APKVISION.ORG with no source stamp and was rejected. The Basic library serves
both packages: besides its own entry points it exports
Java_it_dbtecno_pizzaboyscpro_MainActivity_jniEnableCallback.
here is Basic 1.2.14 (versionCode 43), the Play split set Uptodown serves as an XAPK,
every split carrying the source stamp and signed by the Play App Signing certificate
sha256 5ae32245362ccafab6977e759f658dda66bac81cebdd804581cb55db2f219149, the one
Basic 1.2.4 carried. The Pro on the store is 1.4.34 and no genuine copy of it is
reachable: apkcombo no longer resolves, the APKPure API holds no entry for either
package, APKMirror and Uptodown carry no Pro build, archive.org holds none, and the
one apkvision copy, labelled Pro 1.3.7, is signed CN=APKVISION.ORG with no source
stamp and was rejected. The Basic library serves both packages: besides its own
entry points it exports Java_it_dbtecno_pizzaboyscpro_MainActivity_jniEnableCallback
and Java_it_dbtecno_pizzaboyscpro_MainActivity_jniEnableMultiplayerCallback.
The core is libsc.so, a Rust tree built as one workspace whose compilation units
are named in its own panic and log records: emulated/systems/genesis,
emulated/systems/sms, emulated/systems/mega_cd, emulated/components/cdrom,
emulated/common and frontend/android. The armeabi-v7a build shipped in the split
is stripped and carries no DWARF, so the file and line of every reference below
comes from the Location records the Rust log and panic paths embed. Four machines
run: engine start compares the system name against SMS, GameGear and SegaCD and
falls through to Genesis (lib.rs:481, 517, 538, 550), which covers Master System
and Mark III, Game Gear, Mega Drive and Genesis, and Mega CD and Sega CD. Discs
are read from cue and chd images through components/cdrom.
emulated/common and frontend/android. The arm64-v8a build shipped in the split is
stripped and carries no DWARF, so the file and line of every reference below comes
from the file and line constants the Rust log calls load and the Location records
the panic paths embed. Four machines run: engine start compares the system name
against SMS, GameGear and SegaCD and falls through to Genesis, the branches logging
at lib.rs:569, 590 and 602, which covers Master System and Mark III, Game Gear, Mega
Drive and Genesis, and Mega CD and Sega CD. Discs are read from cue and chd images
through components/cdrom.
Four BIOS slots exist, one per machine, set in one call whose log reads
"jni setBIOSFiles sms: {} gg: {} cd: {} md: {}" (lib.rs:424). A fifth setter stores
a single path in a slot of its own that engine start never reads (lib.rs:416), and
setBIOSBoot logs "TODO jni setBIOSboot" and does nothing. Each branch reads the
slots its machines use, the Master System one reading the Game Gear slot as well,
and an empty slot is an ordinary case for Master System, Game Gear and Mega Drive.
"jni setBIOSFiles sms: {} gg: {} cd: {} md: {}" (lib.rs:475). A fifth setter stores
a single path in a slot of its own that engine start never reads (lib.rs:467), and
setBIOSBoot logs "TODO jni setBIOSboot" and does nothing (lib.rs:493). Each branch
reads the slots its machines use, the Master System one reading the Game Gear slot
as well, and an empty slot is an ordinary case for Master System, Game Gear and Mega
Drive.
Only the Mega CD slot is mandatory: without it the run stops at "MegaCD Bios not
provided" (lib.rs:564) and engine start returns its failure code.
provided" (lib.rs:616) and engine start returns its failure code.
The Mega CD image is the only file the core examines. It is read and its length
compared with 131072, then handed to the machine, which repeats the same
comparison and panics on a mismatch (megacd_main_machine.rs:156-157). Nothing else
about it is tested: no name, no header, no hash, and no region, the Game Region
setting being passed separately as jap, usa or eu and never selecting a file.
The Mega CD image is the only file the core examines. It is read as a plain file and
its length compared with 131072, then handed to the machine, which reads it again,
repeats the same comparison and panics on a mismatch
(megacd_main_machine.rs:169-178). Nothing else about it is tested: no name, no
header, no hash, and no region, the Game Region setting being passed separately as
jap, usa or eu and never selecting a file.
The user supplies each file through the document picker, which filters nothing:
the chosen document is copied into the application temp directory under the name
@@ -95,12 +100,13 @@ files:
"Invalid BIOS len". The core holds one Mega CD slot and applies no other test,
so the boot ROM of any region satisfies it. The three are listed because the
region of the discs decides which one has to be installed.
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:424
(four slot handoff), :517 (SegaCD branch), :564 (absent), :567 (validation
entry), :573 (empty path), :580 (read failure), :592 (length), :596 (accepted);
emulated/systems/mega_cd/src/megacd_main_machine.rs:156-157 (second length test
and panic); SettingsActivity.java:177-219 (picker, zip entry, stored path),
res/xml/pref_general.xml:105-123 (preferences and defaults)"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:475
(four slot handoff), :569 (SegaCD branch), :616 (absent), :619 (validation
entry), :625 (empty path), :632 (read failure), :644 (length), :648 (accepted);
emulated/systems/mega_cd/src/megacd_main_machine.rs:169-178 (second read, length
test and panic); SettingsActivity.java:176-224 (picker, zip entry, stored path),
yg.java:1591-1626 (first file entry), res/xml/pref_general.xml:129-152
(preferences and defaults)"
- name: bios_CD_E.bin
system: sega-megacd
@@ -112,8 +118,8 @@ files:
description: "Mega CD boot ROM"
note: >-
Same slot, same picker and same length test as the other Mega CD boot ROMs.
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:567-596,
emulated/systems/mega_cd/src/megacd_main_machine.rs:156-157"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:619-648,
emulated/systems/mega_cd/src/megacd_main_machine.rs:169-178"
- name: bios_CD_J.bin
system: sega-megacd
@@ -125,8 +131,8 @@ files:
description: "Mega CD boot ROM (Japan)"
note: >-
Same slot, same picker and same length test as the other Mega CD boot ROMs.
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:567-596,
emulated/systems/mega_cd/src/megacd_main_machine.rs:156-157"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:619-648,
emulated/systems/mega_cd/src/megacd_main_machine.rs:169-178"
- name: bios_U.sms
system: sega-mastersystem
@@ -138,9 +144,10 @@ files:
Picked and stored like the Mega CD image and handed to the machine as a path.
Nothing about the file is examined on either side of the bridge, and an empty
slot is not an error: the cartridge runs with the boot sequence skipped.
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:424
(slot), :538 (branch reading the Master System and Game Gear slots),
emulated/systems/sms/src/system.rs:202 (path logged into the machine)"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:475
(slot), :590 (branch reading the Master System and Game Gear slots),
emulated/systems/sms/src/system.rs:200 (path logged into the machine),
emulated/systems/sms/src/sms_machine.rs:95 (detection)"
- name: bios_E.sms
system: sega-mastersystem
@@ -149,8 +156,8 @@ files:
variant_group: "mastersystem-boot-rom"
description: "Master System boot ROM (Europe)"
note: "Same slot and same absence of tests as the other Master System boot ROMs."
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:538,
emulated/systems/sms/src/system.rs:202"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:590,
emulated/systems/sms/src/system.rs:200"
- name: bios_J.sms
system: sega-mastersystem
@@ -159,8 +166,8 @@ files:
variant_group: "mastersystem-boot-rom"
description: "Master System boot ROM (Japan)"
note: "Same slot and same absence of tests as the other Master System boot ROMs."
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:538,
emulated/systems/sms/src/system.rs:202"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:590,
emulated/systems/sms/src/system.rs:200"
- name: bios.gg
system: sega-gamegear
@@ -171,9 +178,8 @@ files:
Its own slot, separate from the Master System one, both read on the branch that
serves the two machines. Picked and stored the same way, handed to the machine
as a path, and never examined. An empty slot is not an error.
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:424
(slot), :481 (system name match, GameGear), :538 (branch reading the Master
System and Game Gear slots)"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:475
(slot), :590 (branch reading the Master System and Game Gear slots)"
- name: bios_MD.bin
system: sega-megadrive
@@ -185,7 +191,7 @@ files:
system name is neither SMS, GameGear nor SegaCD. Picked and stored the same
way and never examined. The machine reports it as "BIOS detected" and runs
without it when the slot is empty.
source_ref: "Pizza Boy SC Basic 1.2.4 libsc.so frontend/android/src/lib.rs:424
(slot), :550 (Genesis branch and slot read),
emulated/systems/genesis/src/system.rs:270 (path logged into the machine),
emulated/systems/genesis/src/genesis_machine.rs:135 (detection)"
source_ref: "Pizza Boy SC Basic 1.2.14 libsc.so frontend/android/src/lib.rs:475
(slot), :602 (Genesis branch and slot read),
emulated/systems/genesis/src/system.rs:268 (path logged into the machine),
emulated/systems/genesis/src/genesis_machine.rs:134 (detection)"