LuluBETAUpdate 2.88
6/13/2026
v2.88.0BETAMINOR
Lulu
LuluMagic DLLs (FFX): Value Workbench for candidate color, speed, timer, and vector edits
Extras -> Magic DLLs (FFX) / Role Candidatesnow includes an editableCandidate Value Workbenchthat scans the selected DLL forfloat32,vec3f/vec4f, andpush imm8/imm32values, classifies candidates as alpha/color/scale/speed/timer/flag/count, and lets the user enter a new decimal/float/comma-vector value,Stage Patch, or emit an output DLL throughApply To Output. TheHost Context / InitMagicPRX Fieldsblock is now assisted too: select a host field, list concrete u32 occurrences in the DLL, and patch one real offset reference. Guardrail: names remain candidates and every change still needs RT2 testing to confirm visual/gameplay semantics. Editor bumped to2.88.0.0. Validation:dotnet build FFXProjectEditor\FFXProjectEditor.csproj -c Release -o work\_build_magicdll_value_workbench_probe --no-restorewith 0 errors / 366 baseline warnings
v2.87.1
v2.88.1BETAPATCHLulu
LuluMagic Viewer Web: Runtime Simulation Candidate in the central stage
- the viewer now has a
Simulatemode that replaces texture slideshow behavior with a continuous loop guided by the reversed structural chain (sub_800530/590/950,sub_80CD60,sub_817200,root+84/root+88, overlay slots, and Phyre payloads).ps3data\magictextures are treated as visual material, not as the clock/frame list; the HUD shows phases, root cursor, code/data callbacks, and repeated DLL aliases. Guardrail: this is aRuntime Simulation Candidate, less fake thanCycle Surface, but still not frame-accurate timing, a complete opcode interpreter, or RT2 correlation of callbacks/frames in-game. Editor bumped to2.88.1.0. Validation:node --check RuntimeTools\FFXMagicViewerWeb\app.js; HTTPhttp://loopback:8766/index.html?magic=0688200; Chromium headless clickedSimulateon desktop and 390px mobile with no page errors/console errors, no mobile horizontal overflow, screenshots atwork/magic_viewer_runtime_simulation_0688.pngandwork/magic_viewer_runtime_simulation_0688_mobile.png; builddotnet build FFXProjectEditor\FFXProjectEditor.csproj -c Release -o work\_build_magic_runtime_sim_2881 --no-restorewith 0 errors / 366 baseline warnings
v2.88.0
v2.88.1.1BETAREVISION
Wakka
WakkaArena+ pre-RT2: versioned research pack for a new NPC option via DLL
- repo-persisted research/RE, with no product behavior change. Versions the Monster Arena/Arena+ dossier set: new tabs/creations, DLL insertion, Dark Aeon/Penance defeat flags, NPC option routing, final scout, and the
nagi0700pre-RT2 dossier. Key finding: the Monster Arena owner lives in eventnagi0700;w0E::f05builds theNow what?menu throughCommon.displayFieldChoice [013B]string[4A],w0E::f07opens the selector throughSgEvent.showModularMenu [401D], launches battles throughBattle.launchBattle [7002], and marks defeated creations0x0300..0x0322throughCommon.setMonsterArenaUnlocked [0210]. Editor bumped to2.88.1.1. Guardrail:research-only/pre-RT2; do not expandArenaUnlocks[35+], do not editnagi0700.ebp, and do not inject a vanilla menu row before live tracing. Validation:Test-Path+rgagainst dossier, KB, and handoff anchors; builddotnet build FFXProjectEditor\FFXProjectEditor.csproj -c Release -o work\_build_versioning_28811 --no-restorewith 0 errors / 366 baseline warnings
v2.88.1
v2.88.1.2BETAREVISIONLulu
LuluMagic DLLs: similar-spell pattern research for safer color/speed hunting
- repo-persisted research/RE, with no product behavior change. Crosses
AiCommandMetadataCatalog.Generated.cs(979rows,689withmoveAnim), overlay CSV (581rows), andmagicFiles\FFX\magic_####.dllbinaries to group by real visual carrier instead of spell name alone. Key findings:Power/hits/status live in the command row; visuals live inmoveAnim; basic Fire/Thunder/Water use the simplernz9/u5family, while Ice/healing/Flare-like effects use wider PPP families; Cure/Potion and many Mixes reuse visuals;Deathproves same-name spells can point to different DLLs; commonDeathmagic_0098andMega Deathmagic_0351share overlay/texture slots/sizes but not hashes/payload; clones0714/0715remain the right path for Prism Flare without touching vanilla Fira/Thundara. Guardrail:pppColor/pppColMove/pppAccele, floats, and pushes remain candidates until RT2/probe proves color, speed, or timing semantics. Editor bumped to2.88.1.2. Validation: document anchors viaTest-Path/rg; buildwork\_build_magic_patterns_28812with 0 errors / 366 baseline warnings
v2.88.1.1
v2.88.1.3BETAREVISION
Seymour
Seymour60fps / FPS unlock research: separating frame generation, frame pacing, and engine-exact 60
- repo-persisted research/RE, with no product behavior change. The dossier
docs/reverse/FFX_60FPS_UNLOCK_FEASIBILITY_RESEARCH_2026-06-13.mdconcludes there is no evidence of a safe one-value 30→60 cap unlock; the honest paths arevisual 60through external frame generation/interpolation, better 30fps frame pacing, 60Hz rendering over 30Hz simulation with internal interpolation, and fullengine-exact 60fpsas a moonshot/research-only lane. Evidence crossed: UnX implements speed hacks by multiplyingFFX_GameTick, not by preserving normal time at 60fps; Special K/UnX warns that external 30fps caps can affect loads and that some menus run at 60; this repo already has DINPUT8/main-thread, a Present hook, and MSEQframeRate=7680 (30fps*256), but magic/battle/cutscene timing is not frame-accurate yet. Safe next step: a read-onlyfps-scoutinFfxHooksDll/FfxDinput8Probethat measures Present, tick, MSEQ cursor, and game mode before any patch. Editor bumped to2.88.1.3. Validation: document anchors viaTest-Path/rg; buildwork\_build_fps_research_28813with 0 errors / 366 baseline warnings
v2.88.1.2
v2.88.1.4BETAREVISIONSeymour
SeymourDeep gameplay-60 research with cutscenes/FMV allowed to remain 30fps
- repo-persisted research/RE, with no product behavior change. The dossier
docs/reverse/FFX_GAMEPLAY_60FPS_DEEP_RESEARCH_2026-06-13.mdanswers the user's new scope: cutscenes may stay 30fps, gameplay is the target. Verdict: this removes a major audiovisual sync class from the first milestone, but it does not turn the problem into a simple cap swap; gameplay still needs separate handling for field, battle, MSEQ, camera, CTB, magic/VFX, menus, loads, and minigames. The research details four routes:visual 60through frame generation/interpolation, frame pacing/VRR/Present doctor, 60Hz rendering over 30Hz simulation with an internal interpolator, and fullengine-exact 60fpsas a moonshot until scouting proves isolatable clocks. Safe next technical step: a read-onlyfps-scoutwith CSV/summary for Present cadence, heartbeat/tick, game mode, MSEQ cursor, and UnX/SpecialK compatibility before any patch. Editor bumped to2.88.1.4. Validation: document anchors viaTest-Path/rg; buildwork\_build_gameplay60_research_28814with 0 errors / 366 baseline warnings
v2.88.1.3
v2.88.1.5BETAREVISIONLulu
LuluMagic DLLs: real Hex-Rays decompilation reveals TWO effect architectures + proven host fields
- repo-persisted RE (decompile + rename/comment in the
.i64s), with no product behavior change. Moving past position-based naming (theMagicDllSemanticAnalyzerheuristic), I actually decompiledmagic_0084andmagic_0148in IDA. Key finding: the corpus has ≥2 distinct architectures that the slot-kind signature does NOT separate (both havecodein every slot): family A "self-contained particle" (magic_0084: local 1023-particle pool + 256-packet ring, nodat_etroot; slot 1 is the draw tick; slot 4 rewrites its own overlay table to advance phase — also confirmed inmagic_0688) and family B "root/record-interpreter" (magic_0148: allocates the 1,024,000-byte root via host+3212, materializes via host+2860, and calls host+2864=sub_80CD60and host+2884=sub_80BEA0directly). Promoted ~20 host fields fromcandidateto proved by decompiled cross-DLL call (host+672 actor, +884/+888 timer, +900/+904/+908 phase/start/progress, +2860 materialize, +2864 interpreter, +2872/+2876 Ego obj, +2908 make-packet) and found the new host+3216 (free) pair of host+3212. Doc:docs/reverse/FFX_MAGIC_DLL_DECOMPILED_FAMILIES_2026-06-13.md. Editor bumped to2.88.1.5. Guardrail: still byte-level RE, names describe role (not original symbol); the slot-kind signature is a weak proxy — the real family classifier is "does slot 0 call host+2860?". Validation: 2.i64saved inmagicFiles\FFXwith rename+comment; renames17/17(0084) and10/10(0148) OK
v2.88.1.4